A UK-based financial institution onboards a new corporate client. The client's ownership structure spans three jurisdictions. A beneficial owner – two levels up the chain – appears on the UK Consolidated List (the list of persons subject to UK financial sanctions, maintained by HM Treasury). The transaction proceeds. Months later, OFSI opens a preliminary investigation. The compliance team had a screening tool. It had a policy document. What it lacked was a sanctions compliance programme that actually worked.
Designing a sanctions compliance programme under OFSI means building a structured, tested system that identifies UK financial sanctions obligations, applies them to the business's specific risk profile, and produces auditable evidence of good-faith compliance. As of July 2026, OFSI assesses a programme across five elements: senior management commitment, risk assessment, internal controls, monitoring and testing, and training. A weak programme does not merely fail a regulatory review – under the Sanctions and Anti-Money Laundering Act ("SAMLA"), OFSI can impose a civil monetary penalty on a strict-liability basis, meaning intent is irrelevant to the threshold question of liability.
This guide walks through each design step in sequence, maps the key differences between OFSI and the OFAC and EU approaches, and identifies the risk flags that most frequently generate enforcement attention.
Step 1 – Understand the governing regime and who it binds
OFSI administers UK financial sanctions under SAMLA and the thematic regulations made under it, covering asset-freezing obligations, prohibitions on making funds and economic resources available, and reporting duties for persons who know or suspect they hold frozen assets. The regime applies to all persons and entities in the United Kingdom, and to UK persons operating abroad – meaning a UK parent, a UK branch, and a UK national working for a foreign subsidiary can each fall within scope simultaneously.
The jurisdictional reach is the first design input. A business with a UK holding company, a European operating subsidiary, and a US trading arm is simultaneously subject to OFSI, to the relevant EU Council regulations enforced by EU member states, and to OFAC under its own rules. Each regime has its own list, its own ownership-and-control test, and its own reporting window. A programme designed for one will not automatically satisfy the others. In our experience, this jurisdictional layering is where cross-border businesses carry their highest latent risk: the policy says "we screen against UK, EU, and US sanctions lists" but the operational reality is a single-feed tool that pulls only one list on any given day.
The OFSI ownership-and-control test is the foundation of the scope analysis. Ownership and control (the UK test for whether a non-listed entity is caught through a listed person's holdings) asks whether a designated person owns 50 per cent or more of the shares or voting rights, or otherwise controls the entity. The EU equivalent is materially similar. OFAC's 50 percent rule (OFAC's rule treating entities owned 50 percent or more by blocked persons as themselves blocked) is mechanical and does not extend to a standalone "control" limb in the same way. The practical difference matters: an entity where a designated person holds 45 per cent and exercises board control may be caught under OFSI but requires a more fact-specific OFAC analysis. Build the scope mapping with that distinction explicit.
Step 2 – Conduct the foundational risk assessment
A sanctions risk assessment is the document that translates the regulatory obligation into your specific business context. It identifies which sanctions programmes are relevant, which counterparty categories carry elevated risk, and which internal processes are the most likely points of failure. Without it, a compliance programme is a generic policy – not a risk-based system.
The assessment should map exposure across at least four dimensions. First, counterparty risk: who are your customers, suppliers, and intermediaries, and in which jurisdictions? Second, product and service risk: do your transactions involve goods, services, or financial flows that are more commonly implicated in sanctions evasion – high-value commodities, technology goods with dual-use potential, trade-finance instruments, or correspondent banking flows? Third, geographic risk: do you operate in, or route payments through, jurisdictions subject to thematic or comprehensive sanctions programmes? Fourth, channel risk: are you transacting through intermediaries, agents, or introduced business where you do not see the underlying beneficial owner directly?
OFSI's published enforcement guidance places weight on whether the business conducted a proportionate risk assessment before the breach occurred. A business that had no assessment at all starts in a significantly weaker position than one that assessed and managed the risk, even if imperfectly. Have you documented who signed off the assessment and when it was last updated?
The risk assessment must be a living document. Sanctions lists change frequently. A counterparty that passed screening in January may be designated in March. A thematic programme may expand to cover a new sector. Build the review cycle into the governance calendar, not just into the policy.
Step 3 – Design the internal controls
Internal controls are the operational mechanisms that operationalise the risk assessment. They are the point at which a programme either works or does not. For most businesses subject to OFSI, the control architecture covers three layers: pre-transaction screening, ownership and control analysis, and transaction monitoring.
Pre-transaction screening must run against the UK Consolidated List, the UN Consolidated List (the list maintained by the Security Council), and – for businesses with US or EU nexus – the OFAC SDN List and the EU asset-freeze lists. Running only one list is a design failure. Screening must also cover beneficial owners, not just the named counterparty. A screening tool that checks the company name but does not resolve the ownership chain to identify individuals will miss the most common designation pattern, which involves a corporate entity whose beneficial controller is the listed person.
Ownership and control analysis should be triggered automatically when beneficial ownership data is incomplete or when a counterparty operates in a higher-risk jurisdiction. This is not the same as the initial screening run. It requires a structured review of corporate registry data, ultimate beneficial owner declarations, and – for complex structures – a written assessment of whether any listed person meets the ownership or control threshold. In our practice, businesses consistently underinvest in this step. Screening the name takes seconds; tracing a five-layer holding structure takes hours. The programme must allocate that time.
Transaction monitoring is the ongoing layer. Unlike the pre-transaction checks, it operates across the life of a relationship and should flag changes in the counterparty's structure, new designations that affect existing customers, and payment patterns that are inconsistent with the stated business purpose. For financial institutions, this layer also supports the reporting obligation under SAMLA: a firm that holds or controls frozen assets – or knows or suspects it does – must report to OFSI. The position above covers the standard case. Your facts – the counterparty, the asset type, the structure, the regime in play – change the analysis.
For an assessment of your current controls under OFSI, contact Calder & Vance at info@caldervance.com.
How does the cross-regime picture affect control design?
A programme designed exclusively for OFSI will have gaps for any business with US or EU activity, and those gaps can be expensive. OFAC and OFSI differ in three ways that directly affect control architecture.
First, list composition. The UK Consolidated List, the OFAC SDN List (OFAC's list of Specially Designated Nationals and blocked persons), and the EU asset-freeze lists overlap substantially but are not identical. A person or entity may be designated under one regime and not another, particularly following divergence in UK, US, and EU foreign policy since 2020. A screening system that pulls only one list misses the regime-specific designations that carry the highest enforcement risk for the relevant authority.
Second, the ownership and control test. As noted in Step 1, OFSI applies both an ownership limb (the 50 per cent or more threshold) and a control limb. The EU position under the relevant Council regulations is structurally similar. OFAC's 50 percent rule is mechanical and aggregate but does not carry an equivalent free-standing control limb in the same form. Designing a single control that satisfies the OFSI and EU control tests will generally exceed the OFAC threshold requirement – but not vice versa. Build to the higher standard.
Third, reporting obligations and timelines. OFSI requires reporting by a person who knows or suspects they hold frozen assets or have information relevant to OFSI's functions. Other regimes carry different reporting triggers, different timelines, and different addressees. A business that has a single "sanctions reporting procedure" without regime-specific routing will, in practice, report to the wrong authority or miss the relevant window. We regularly advise clients on building regime-specific reporting matrices that sit within a single operational workflow.
The EU General Court and the UK courts have also taken different positions on the evidential standard required to sustain a designation challenge. That matters for delisting strategy but also for control design: a business that receives a regulatory query from OFSI benefits from having documentation built to a standard that would survive legal scrutiny, not just an audit review.
Step 4 – Training, testing, and the monitoring cycle
A programme that has never been tested has not been validated. OFSI's enforcement guidance and the broader five-element standard applied across UK, US, and EU sanctions compliance frameworks all require that training and testing are built into the programme, not bolted on as an afterthought.
Training must reach the right people at the right frequency. A financial institution needs a different training architecture from an industrial exporter. For a bank, the front office, the payments team, the correspondent banking team, and the compliance function each have distinct exposure points and need role-specific content, not a generic annual module. For an exporter, the sales team handling distributor relationships, the trade-finance team, and the logistics function are the primary risk-bearing roles. Who has completed training, and when, should be recorded and reportable.
Testing takes two forms. First, periodic internal audit or compliance testing: running the screening controls against a test population that includes known-listed entities to verify that the system fires correctly. Second, scenario-based testing: presenting compliance staff with realistic case studies that mirror actual risk patterns – a counterparty with a partially obscured ownership chain, a payment that routes through a high-risk intermediary, an existing customer who is newly designated. The testing should be documented, the results should be reviewed by senior management, and identified gaps should generate a remediation plan with a completion date.
The monitoring cycle closes the loop. OFSI publishes updated guidance periodically. The UK Consolidated List is updated without notice when a new designation is made. Thematic sanctions regulations are amended by statutory instrument. A programme that was well-designed in one calendar year may be out of step with the current regulatory position by the next. The review cycle – at minimum annual, and triggered by a material designation update or a regulatory change – must be built into the governance calendar at a senior level. If a transaction has already been flagged, or a regulatory query has been received, an early review can preserve options that narrow with time.
Contact Calder & Vance at info@caldervance.com for a confidential review of a potential breach or a gap in your current programme.
Step 5 – Senior management commitment and governance accountability
Senior management commitment is not a box-ticking element. OFSI's enforcement guidance explicitly references the governance and accountability structure of a business when assessing the adequacy of a compliance response and when applying the penalty methodology. A civil monetary penalty calculation under SAMLA takes account of whether senior management were aware of and supported the compliance function, and whether they responded appropriately when a breach was identified.
In practical terms, senior management commitment requires four things. First, a named senior individual with responsibility for the sanctions compliance programme – not shared accountability, but a specific designation. Second, board or senior leadership-level sign-off on the risk assessment and programme design, with documented evidence. Third, an escalation path that reaches senior management directly for material sanctions questions, without filtering through layers of middle management that may not recognise the significance of an issue. Fourth, a response protocol: what does the firm do in the first 24 hours after a potential breach is identified?
That last point is where programmes most commonly fail under enforcement scrutiny. In a recent matter, a manufacturing business facing a potential OFSI breach had a well-documented screening system and a clear risk assessment. Its response protocol, however, had never been tested. When the breach was identified, the escalation chain was followed – but slowly, and without the urgency that the reporting window required. We assisted the client in scoping the apparent violation, advising on the voluntary self-disclosure route (a VSD – a proactive report of a potential breach to OFSI before the regulator identifies it), and preparing the submission. The outcome was treated as a co-operative response by the regulator. The lesson: the response protocol is as important as the preventive controls.
OFSI's enforcement guidance indicates that a VSD, made promptly and accurately, is a mitigating factor in the penalty assessment. It does not guarantee a reduced penalty or a non-penalty outcome, but the absence of a VSD where one was appropriate is consistently treated as an aggravating factor. Build the VSD decision into the response protocol explicitly.
Common mistakes and the myth about proportionality
The most common mistake in sanctions compliance programmes is designing the programme to the size of the business rather than the risk. A small business with a large cross-border exposure needs a more developed control architecture than a large business with purely domestic activity. OFSI's approach to proportionality does not reduce the obligation to comply; it affects only the form and depth of the controls required to satisfy the obligation.
The myth we most often encounter is that a proportionality argument insulates a smaller business from enforcement action. It does not. OFSI has taken enforcement action against businesses of all sizes. The proportionality argument goes to the depth of documentation and the sophistication of the controls, not to whether the controls existed at all. A company with five employees and a cross-border payment flow still needs a documented screening procedure, a record of what was checked and when, and a named person responsible for sanctions compliance.
Other frequent risk flags include: screening tools that are not configured to match against aliases and alternative name spellings; beneficial ownership data that is collected once at onboarding and never refreshed; training records that list completion dates but cannot demonstrate what was actually covered; and escalation procedures that name a compliance officer who left the business two years ago. These are not sophisticated failures. They are process gaps that a periodic review would surface. We have acted for clients in remediation exercises after OFSI enquiries, and these gaps appear with notable consistency.
A related risk: confusing a sanctions policy with a sanctions programme. A policy document states what the firm will do. A programme is the evidence that it actually does it. OFSI distinguishes between the two in its enforcement assessments, and so should every compliance function.
Related practices
- Sanctions compliance audit and testing (Australia) – independent testing of sanctions controls against the Australian autonomous sanctions regime
- Sanctions compliance programme design – OFSI guide, part 3 – deeper analysis of OFSI licensing, reporting obligations, and enforcement posture